Selling CVV or CVC data through a website is illegal in the United States. A CVV is a card verification value that exists to prove the cardholder is holding the physical card, so trading those codes online is carding, a form of access device fraud. There is no lawful business model for a site that sells CVV numbers, and PCI DSS bars merchants from storing them once a transaction is authorized.
What does "selling CVV through a website" actually mean?
The phrase describes storefronts that advertise stolen card verification values, usually taken from breached merchants or skimmed at fuel pumps and payment terminals. Operators bundle the codes with cardholder names, expiration dates, and billing ZIP codes, then sell access by subscription or per record. Buyers are other criminals who use the data for card-not-present purchases.
CVV Selling Website Buying Guide
Which U.S. laws make CVV trafficking a crime?
Federal prosecutors charge CVV sales under 18 U.S.C. 1029, which covers trafficking in unauthorized access devices and carries a statutory maximum of 10 years in prison for a first offense. Related counts often include wire fraud, aggravated identity theft, and money laundering. State statutes add their own penalties, and card networks pursue civil recovery against operators and their processors.
Why do most CVV listings fail anyway?
Issuers cancel compromised numbers quickly, so a purchased record often dies before anyone can use it. Address Verification System checks and 3-D Secure challenges block transactions where the billing data does not match the card. Many listings are fabricated outright, which is why buyers in these markets get defrauded about as often as cardholders.
How do merchants detect CVV resale activity?
- CVV mismatch response codes clustered on one merchant account.
- Velocity spikes in card-not-present orders from a narrow IP range.
- High failure rates at 3-D Secure step-up authentication.
- Chargeback ratios that cross network thresholds.
Fraud teams combine those signals with device fingerprinting and machine learning scoring. A sudden wave of CVV failures usually traces to a testing script rather than real shoppers. Blocking the BIN range and forcing authentication stops most of it.
Can a website store CVV numbers at all?
No. PCI DSS Requirement 3.2 prohibits storing sensitive authentication data, including CAV2, CVC2, CVV2, and CID, after authorization, even in encrypted form. Tokenization and network tokens let a merchant reuse a card without ever touching the verification value. Any site that claims to hold CVV data for later use is out of compliance by definition.
What should you do if your CVV is exposed?
Call the issuer, ask for a replacement card with a new number, and review recent statements line by line. Report the theft at IdentityTheft.gov and consider a credit freeze with the three bureaus. Under the Fair Credit Billing Act, consumer liability for unauthorized card charges is capped at $50, and most issuers waive even that.
How do you report a website selling CVV data?
File a complaint with the FBI Internet Crime Complaint Center and the FTC, then forward the domain to the card network's fraud tip line. Hosting providers and registrars also accept abuse reports and will suspend a site after review. Include screenshots and the exact URL, because investigators work from dated evidence.
Frequently asked questions
Is it legal to sell CVV data from your own card?
No. Sharing or selling your own card verification value exposes the account to fraud and can still violate network rules and access device statutes. No legitimate market exists for CVV codes.
Do CVV checker tools work?
They are built to fail or to take payment from the person running them. A tool that validates card numbers without merchant authorization is itself an access device offense.
Why do card issuers use CVV at all?
The code proves the physical card is present during a card-not-present transaction. It is a fraud signal, not a password, and it should never be shared by email, chat, or a form on an untrusted page.